Managing Route53 DNS Access with IAM: A Granular Approach

Introduction

When managing DNS records in AWS Route53, it’s crucial to follow the principle of least privilege. This article demonstrates how to create an IAM policy that allows specific groups to manage DNS records in designated hosted zones while maintaining security best practices.

Note: The hosted zone IDs in this example are placeholders. Always replace them with your actual hosted zone IDs when implementing the policy.

The Policy Explained

The following IAM policy provides a balanced approach to DNS management, allowing users to:

1. List and view hosted zones (read-only access to all zones)
2. View and manage records in specific hosted zones
3. Make changes only to designated hosted zones

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:GetHostedZoneCount",
                "route53:ListHostedZonesByName",
                "route53:ListTagsForResource"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "route53:GetHostedZone",
                "route53:ListResourceRecordSets",
                "route53:GetHostedZoneLimit"
            ],
            "Resource": "arn:aws:route53:::hostedzone/*"
        },
        {
            "Effect": "Allow",
            "Action": "route53:ChangeResourceRecordSets",
            "Resource": [
                "arn:aws:route53:::hostedzone/Z1234567890EXAMPLE1",
                "arn:aws:route53:::hostedzone/Z0987654321EXAMPLE2"
            ]
        }
    ]
}

Breaking Down the Policy

Statement 1: Read-Only Access to Hosted Zone Listings

{
    "Effect": "Allow",
    "Action": [
        "route53:ListHostedZones",
        "route53:GetHostedZoneCount",
        "route53:ListHostedZonesByName",
        "route53:ListTagsForResource"
    ],
    "Resource": "*"
}

This statement allows users to:

• List all hosted zones in the account
• Get the total count of hosted zones
• List hosted zones by name
• View tags associated with resources

The Resource: "*" is necessary here because these are account-level operations that don’t operate on specific resources.

Statement 2: Read Access to All Hosted Zones

{
    "Effect": "Allow",
    "Action": [
        "route53:GetHostedZone",
        "route53:ListResourceRecordSets",
        "route53:GetHostedZoneLimit"
    ],
    "Resource": "arn:aws:route53:::hostedzone/*"
}

This statement provides read-only access to all hosted zones, allowing users to:

• View details of any hosted zone
• List all resource record sets in any zone
• Check hosted zone limits

Statement 3: Write Access to Specific Hosted Zones

{
    "Effect": "Allow",
    "Action": "route53:ChangeResourceRecordSets",
    "Resource": [
        "arn:aws:route53:::hostedzone/Z1234567890EXAMPLE1",
        "arn:aws:route53:::hostedzone/Z0987654321EXAMPLE2"
    ]
}

This is the most restrictive statement, allowing users to:

• Make changes to resource record sets
• Only in the specifically listed hosted zones
• No changes allowed to other hosted zones

Security Note: When implementing this policy, replace the example hosted zone IDs (Z1234567890EXAMPLE1 and Z0987654321EXAMPLE2) with your actual hosted zone IDs. Never share or commit actual hosted zone IDs in documentation or code repositories.

Best Practices Implemented

1. Principle of Least Privilege: The policy grants only the necessary permissions for each operation.
2. Separation of Concerns: Read operations are separated from write operations.
3. Granular Control: Write access is restricted to specific hosted zones.
4. Resource-Level Permissions: Uses specific ARNs for write operations.

How to Use This Policy

1. Create a new IAM policy in the AWS Console or using AWS CLI
2. Copy the policy JSON
3. Replace the hosted zone IDs with your specific zone IDs
4. Attach the policy to an IAM group or role
5. Add users to the group or assign the role as needed

Security Considerations

• Regularly review and update the list of allowed hosted zones
• Monitor CloudTrail logs for any unauthorized attempts to modify DNS records
• Consider using AWS Organizations to further isolate DNS management
• Implement MFA for users with DNS management permissions
• Never expose actual hosted zone IDs in documentation or code
• Use placeholder values in examples and documentation
• Consider using AWS Systems Manager Parameter Store or Secrets Manager to store sensitive resource identifiers

Conclusion

This policy provides a secure and flexible way to manage DNS records in Route53. It allows teams to manage their specific hosted zones while preventing unauthorized changes to other zones. Remember to regularly audit the policy and update the hosted zone list as your infrastructure evolves.